Date: Tue, 25 Oct 2016 10:42:16 +0200 From: Tomas Hoger <thoger@...hat.com> To: Gsunde Orangen <gsunde.orangen@...il.com> Cc: oss-security@...ts.openwall.com, Dawid Golunski <dawid@...alhackers.com> Subject: Re: CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) On Tue, 18 Oct 2016 22:56:18 +0200 Gsunde Orangen wrote: > Dawid meanwhile updated his post  to reflect that the fixes for > CVE-2016-6662 were added in 5.5.52/5.6.33/5.7.15. > ... But today Oracle states that those versions were still affected > , thus the fix releases are 5.5.53/5.6.34/5.7.16. 5.5.53/5.6.34/5.7.16 change the defaults for secure_file_priv - the change that should break privilege escalation from FILE privilege to database administrator. See upstream release notes for details. > So which one is correct? Based on the changelogs I assume . The advisory is not very explicit regarding which issue the CVE is for, which leaves space for using it to refer to any related change. Mitre CVE description is more specific and says the id is for "general log can write to my.cnf". That description is consistent with how the id was used by MariaDB upstream, or where Dawid's advisory says it was fixed. > And btw, Dawid: what happened with CVE-2016-6663? Still not public > yet? That CVE is now listed as fixed in MariaDB 5.5.52 and 10.1.18. Based on information from MariaDB upstream, the CVE is used for the race condition issue fixed in this commit: https://github.com/MariaDB/server/commit/347eeefbfc658c8531878218487d729f4e020805 MySQL fixed the issue in: https://github.com/mysql/mysql-server/commit/4e5473862e6852b0f3802b0cd0c6fa10b5253291 Looking at the Oracle CPU, it seems CVE-2016-5616 is Oracle's dupe of CVE-2016-6663. It would be nice to have this conclusion confirmed by Oracle, but frankly, we're unlikely to see that. However, Dawid, as the original reporter, can ask Oracle what CVEs they assigned to issues he reported, and share the response. -- Tomas Hoger / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ